Group
The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Description | desc |
String | The group description. |
| Domain | domain |
String | The domain where the group is defined. For example: the LDAP or Active Directory domain. |
| Name | name |
String | The group name. |
| Privileges | privileges |
String[] | The group privileges. |
| Raw Data | raw_data |
JSON | The event data as received from the event source. |
| Record ID | record_id |
String | Unique identifier for the object |
| Account Type | type |
String | The type of the group or account. |
| Unique ID | uid |
String | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. |
| Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
Relationships
Inbound Relationships
These objects and events reference Group in their attributes:
- Linux Process
- Resource Details
- Table
- Incident Finding
- Database
- Policy
- User
- API
- Admin Group Query
- Device
- Authorize Session
- Databucket
- Group Management
- Managed Entity
Outbound Relationships
Group references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated about 17 hours ago